Risk Engine Dashboard | Project Case Study

Product Walkthrough

Overview

The Risk Engine is a serverless fraud detection platform built on AWS. Transactions arrive at API Gateway, are validated by an Ingest Lambda, then routed through EventBridge to a Scorer Lambda. The scorer writes results to DynamoDB. The entire backend is defined as infrastructure-as-code in AWS SAM. A React and TypeScript analyst dashboard, delivered via CloudFront, shows scored transactions, risk factor breakdowns, and alert queues.

Backend Architecture

An API Gateway REST endpoint receives transaction payloads. An Ingest Lambda validates the schema and publishes a structured event to EventBridge. A Scorer Lambda consumes the event, runs the multi-factor risk model, and writes the scored result to DynamoDB. Both Lambda functions emit structured JSON logs to CloudWatch. IAM execution roles enforce least-privilege access across all service boundaries.

Backend Architecture Diagram · Official AWS Icons

Event flowObservability (CloudWatch)IAM least-privilegeIcons: AWS Architecture Icons (official)

Architecture icons: aws.amazon.com/architecture/icons

Event Flow: Transaction to Score

1

Transaction Submitted: API Gateway

Client sends POST /score with the transaction payload. API Gateway validates the request against a JSON Schema model. Invalid payloads return 400 without invoking Lambda. AWS DocsAPI Gateway request validation

2

Ingestion: Lambda Ingest Function

The Lambda function validates domain rules, generates a transactionId (UUID v4), and publishes a TransactionReceived event to EventBridge. Structured JSON logs go to CloudWatch Logs. Returns 202 Accepted to the caller. AWS DocsLambda structured logging

3

Routing: EventBridge Rule

The EventBridge rule matches the event on source and detail-type, and routes it to the Scorer Lambda. If delivery fails after retries, the event goes to the SQS dead-letter queue. AWS DocsEventBridge dead-letter queues

4

Scoring: Lambda Scorer Function

The scoring engine evaluates five weighted risk factors, sums them into a composite score (0–100), applies classification thresholds, and constructs the full RiskScore record. Emits scoring metrics as CloudWatch EMF structured log entries. AWS DocsCloudWatch Embedded Metric Format

5

Persistence: DynamoDB PutItem

The scored record is written to DynamoDB with the composite key transactionId / timestamp and a 90-day TTL. The write is conditional on the item not already existing, preventing duplicate processing from EventBridge retries. AWS DocsDynamoDB conditional expressions

6

Dashboard Query: Analyst Review

The React dashboard queries scored transactions via API Gateway (GET /transactions), filtering by classification or merchant using DynamoDB GSI queries. REVIEW and BLOCK classifications populate the analyst queue with full factor breakdowns. AWS DocsDynamoDB Global Secondary Indexes

Risk Scoring Engine

The scoring engine is a deterministic, stateless TypeScript module deployed as the Scorer Lambda handler. Each transaction event is evaluated against five weighted risk signals. Factors are summed into a composite score. The score maps to a classification via configurable thresholds. The same module runs in the browser for the demo.

// Core types: same interface in Lambda handler and browser demo
interface Transaction {
  id:          string
  amount:      number          // USD
  merchantId:  string
  country:     string          // ISO 3166-1 alpha-2
  cardPresent: boolean
  velocity:    number          // transactions / hour on this card
  timestamp:   string          // ISO 8601
}

interface RiskScore {
  transactionId:  string
  score:          number        // 0–100
  factors:        RiskFactor[]  // ordered by weight descending
  classification: 'PASS' | 'REVIEW' | 'BLOCK'
  scoredAt:       string        // ISO 8601
}

type RiskFactor =
  | { type: 'HIGH_AMOUNT';      weight: number; value: number }
  | { type: 'GEO_MISMATCH';     weight: number; countryRisk: string }
  | { type: 'HIGH_VELOCITY';    weight: number; txPerHour: number }
  | { type: 'CARD_NOT_PRESENT'; weight: number }
  | { type: 'ODD_HOURS';        weight: number; hour: number }

Factor: High Amount (max 30 pts)

Transactions above $500 receive progressive weight scaling linearly to 30 points at $2,000+. Configurable per merchant category code: travel merchants carry a higher baseline than grocery.

Factor: Geographic Risk (max 25 pts)

Transaction country is resolved against a tiered risk register. High-risk jurisdictions contribute up to 25 points. A mismatch between transaction country and the card issuing country adds a flat 15-point penalty regardless of tier.

Factor: Transaction Velocity (max 20 pts)

More than 3 transactions per hour on the same card signals elevated activity. Above 10/hour, the factor reaches maximum contribution. Velocity is computed over a rolling window from DynamoDB transaction history in the production path.

Classification Thresholds

Score 0–39: PASS. Score 40–69: REVIEW, written to the analyst queue. Score 70–100: BLOCK, transaction declined. Thresholds are environment variables on the Scorer Lambda and can be tuned without a code deployment.

Design note: The scoring module is pure TypeScript with no AWS SDK dependency. It receives a plain Transaction object and returns a RiskScore. The Lambda handler is a thin wrapper that deserialises the EventBridge event, calls the scorer, and writes to DynamoDB. This makes the engine independently testable without mocking any AWS service.

DynamoDB Data Model

A single DynamoDB table stores all scored transactions. The access patterns drive the key design: fast single-item lookup by ID, merchant-level queries for operations teams, and classification-based queuing for analysts.

Table: RiskEngineTransactions
Billing: PAY_PER_REQUEST (On-Demand)
TTL attribute: ttl (Unix epoch, 90 days from scoredAt)

┌──────────────────────────────────────────────────────────────────┐
│ Key        │ Attribute         │ Type   │ Notes                   │
├──────────────────────────────────────────────────────────────────┤
│ PK         │ transactionId     │ String │ UUID v4                 │
│ SK         │ timestamp         │ String │ ISO 8601, sort key      │
├──────────────────────────────────────────────────────────────────┤
│ (data)     │ amount            │ Number │                         │
│            │ country           │ String │ ISO 3166-1 alpha-2      │
│            │ merchantId        │ String │                         │
│            │ cardPresent       │ Bool   │                         │
│            │ riskScore         │ Number │ 0–100                   │
│            │ classification    │ String │ PASS | REVIEW | BLOCK   │
│            │ factors           │ List   │ RiskFactor[]            │
│            │ ttl               │ Number │ Unix epoch              │
└──────────────────────────────────────────────────────────────────┘

GSI 1: MerchantIndex
  PK: merchantId   SK: timestamp
  → Merchant-level transaction history, time-sorted

GSI 2: ClassificationIndex
  PK: classification   SK: timestamp
  → Analyst review queue (REVIEW / BLOCK, newest first)

Conditional Write: Idempotency

The Scorer Lambda writes with a ConditionExpression: attribute_not_exists(transactionId). If EventBridge retries the event after a transient failure, a duplicate PutItem is silently rejected rather than overwriting the original scored record.

AWS DocsDynamoDB condition expressions

TTL: Automatic Expiry

Records expire after 90 days via DynamoDB TTL. Expired items are deleted asynchronously at no additional cost. This bounds storage cost without a scheduled cleanup job.

AWS DocsDynamoDB Time to Live (TTL)

GSI: Merchant Review Queries

Querying GSI 1 with merchantId and a timestamp range returns all transactions for a merchant in chronological order. This supports the operations team workflow of reviewing all activity for a merchant over a time window.

AWS DocsDynamoDB Global Secondary Indexes

GSI: Analyst Alert Queue

Querying GSI 2 with classification=REVIEW (or BLOCK) and a timestamp sort returns the alert backlog newest-first. This is the primary read pattern for the analyst dashboard: a single targeted query, no table scan.

AWS DocsDynamoDB Query operation

Infrastructure as Code: AWS SAM

The entire backend is defined in an AWS SAM template. Lambda functions, API Gateway, DynamoDB, EventBridge rules, IAM roles, and CloudWatch alarms are all version-controlled and deployable from a single sam deploy command. No resources are created manually.

# template.yaml (abbreviated)
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Globals:
  Function:
    Runtime: nodejs20.x
    Timeout: 10
    MemorySize: 256
    Environment:
      Variables:
        TABLE_NAME: !Ref TransactionsTable
        EVENT_BUS_NAME: !Ref RiskEventBus

Resources:

  RiskEventBus:
    Type: AWS::Events::EventBus
    Properties:
      Name: risk-engine-bus

  IngestFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: src/ingest/handler.handler
      Policies:
        - EventBridgePutEventsPolicy:
            EventBusName: !Ref RiskEventBus
      Events:
        ScoreApi:
          Type: Api
          Properties:
            Path: /score
            Method: post
            RestApiId: !Ref RiskApi

  ScorerFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: src/scorer/handler.handler
      Policies:
        - DynamoDBWritePolicy:
            TableName: !Ref TransactionsTable
      Events:
        TransactionReceived:
          Type: EventBridgeRule
          Properties:
            EventBusName: !Ref RiskEventBus
            Pattern:
              source: [ "risk-engine" ]
              detail-type: [ "TransactionReceived" ]

  TransactionsTable:
    Type: AWS::DynamoDB::Table
    Properties:
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
        - { AttributeName: transactionId,   AttributeType: S }
        - { AttributeName: timestamp,       AttributeType: S }
        - { AttributeName: merchantId,      AttributeType: S }
        - { AttributeName: classification,  AttributeType: S }
      KeySchema:
        - { AttributeName: transactionId, KeyType: HASH  }
        - { AttributeName: timestamp,     KeyType: RANGE }
      GlobalSecondaryIndexes:
        - IndexName: MerchantIndex
          KeySchema:
            - { AttributeName: merchantId, KeyType: HASH  }
            - { AttributeName: timestamp,  KeyType: RANGE }
          Projection: { ProjectionType: ALL }
        - IndexName: ClassificationIndex
          KeySchema:
            - { AttributeName: classification, KeyType: HASH  }
            - { AttributeName: timestamp,       KeyType: RANGE }
          Projection: { ProjectionType: ALL }
      TimeToLiveSpecification:
        AttributeName: ttl
        Enabled: true

SAM Transform: Serverless Abstractions

SAM extends CloudFormation with higher-level resource types (AWS::Serverless::Function, AWS::Serverless::Api). The transform expands these into the underlying CloudFormation resources: Lambda functions, execution roles, API Gateway stages, and deployment groups, without requiring manual IAM or APIGW configuration.

AWS DocsAWS SAM specification

sam build + sam deploy

sam build compiles TypeScript, installs production dependencies, and packages each function as a separate Lambda deployment archive. sam deploy uploads the artifacts to S3 and executes the CloudFormation change set. A full environment deploy takes under 2 minutes from a clean state.

AWS Docssam deploy reference

Managed Policies: Least Privilege

SAM connectors and managed policy templates (EventBridgePutEventsPolicy, DynamoDBWritePolicy) generate scoped IAM statements automatically, each scoped to the specific resource ARN. No wildcard actions or resource ARNs exist in the produced CloudFormation.

AWS DocsSAM policy templates

Repeatable, Environment-Isolated Deploys

Separate CloudFormation stacks for dev and prod ensure environment isolation. Parameter overrides (stage name, DLQ ARN, threshold values) are passed at deploy time. The same template.yaml deploys both environments without branching the IaC.

AWS DocsDeploying serverless applications

Dashboard Delivery Architecture

The analyst dashboard is a React and TypeScript SPA built with Vite, deployed to S3, and served via CloudFront at /risk-engine/*. It shares the same CloudFront distribution as the portfolio site: one WAF Web ACL, one ACM certificate, one origin access control configuration.

Architecture Diagram · Official AWS Icons

Request flowTLS (ACM)ObservabilityOrigin Access ControlIcons: AWS Architecture Icons (official)

Monitoring and Alerting

Lambda: Duration, Errors, Throttles

CloudWatch publishes Lambda metrics per function: Duration (P50/P95/P99), Errors (count), Throttles, ConcurrentExecutions. Alarms fire on Errors > 0 sustained over 5 minutes and P99 Duration > 5,000 ms. SNS delivers alerts to the operator email.

AWS DocsLambda CloudWatch metrics

API Gateway: 4xx / 5xx / Latency

API Gateway publishes 4XXError, 5XXError, Count, Latency, and IntegrationLatency per stage. An alarm on 5XXError > 1 per minute indicates Lambda invocation failures. This separates client errors (4xx) from backend failures (5xx).

AWS DocsAPI Gateway CloudWatch metrics

CloudWatch Logs: Structured JSON

Both Lambda functions emit structured JSON log entries using the CloudWatch Embedded Metric Format (EMF). EMF embeds custom metrics (riskScore, classification, scoringDurationMs) directly in log events, queryable in CloudWatch Logs Insights without a separate metric filter.

AWS DocsCloudWatch Embedded Metric Format

DynamoDB: Consumed Capacity + Throttles

DynamoDB publishes ConsumedReadCapacityUnits, ConsumedWriteCapacityUnits, ThrottledRequests, and SystemErrors per table. An alarm on ThrottledRequests > 0 in On-Demand mode indicates an unexpected burst beyond the table's burst capacity.

AWS DocsDynamoDB CloudWatch metrics

Security Considerations

Scaling Strategy

Lambda: Automatic Concurrency Scaling

Lambda scales from 0 to the account concurrency limit (10,000) in response to incoming events. For fraud scoring, provisioned concurrency on the Scorer function eliminates cold starts. Scoring latency stays consistent regardless of whether the function has been idle.

AWS DocsLambda provisioned concurrency

API Gateway: Throttling and Burst

API Gateway has a default burst limit of 5,000 requests and a steady-state limit of 10,000 requests per second. Usage plans can throttle individual API keys, protecting the backend from a single misconfigured client saturating the scoring pipeline.

AWS DocsAPI Gateway throttling

EventBridge: Decoupled Throughput

EventBridge handles millions of events per second natively. Decoupling ingestion from scoring means a spike in transaction volume increases Ingest Lambda concurrency but does not directly compete with Scorer Lambda. Each scales independently based on its own event rate.

AWS DocsEventBridge service quotas

DynamoDB On-Demand: Zero Capacity Planning

On-Demand mode instantly accommodates up to double the previous peak throughput. There are no capacity units to provision, no throttling risk at normal burst, and no cost for idle capacity. Transaction-level writes are the dominant pattern: single-item PutItems with a TTL.

AWS DocsDynamoDB On-Demand mode

Cost Notes

Cost scales directly with usage. There are no reserved instances or minimum fees for the backend compute layer. At demo-level traffic, the backend cost is effectively zero.

Service	Free Tier	Production Cost Driver
Lambda	1M requests / month free	~$0.20 per 1M invocations + duration
API Gateway	1M calls / month free (12 mo)	$3.50 per million calls (REST)
EventBridge	1M events / month free (custom bus)	$1.00 per million events
DynamoDB	25 GB + 25 WCU + 25 RCU free	On-Demand: $1.25 / million writes
CloudWatch	10 custom metrics + 5 GB logs free	$0.30 per GB ingested above free
S3 (dashboard)	5 GB free	Negligible: ~50 KB assets
CloudFront	1 TB transfer / month free	Shared distribution, no extra cost

At 100,000 scored transactions/month, total backend cost is under $2/month. At 10 million transactions/month, the cost is approximately $35–$50/month, far less than an equivalent always-on EC2 or container-based scoring service. AWS DocsLambda pricing · AWS DocsDynamoDB pricing

AWS Well-Architected Framework

AWS DocsAWS Well-Architected Framework · AWS DocsServerless Applications Lens

Future Improvements

Amazon Cognito: Analyst Authentication

Gate the dashboard and the GET /transactions API behind Cognito User Pools. API Gateway authorises requests using a Cognito authoriser: only JWTs from the risk engine user pool are accepted. Analyst roles are mapped to Cognito groups with different IAM permissions for REVIEW vs BLOCK queues.

AWS DocsAPI Gateway Cognito authoriser

Kinesis Data Streams: High-Volume Ingest

For transaction volumes above ~1,000/second, replace API Gateway with Kinesis Data Streams as the ingest layer. The Ingest Lambda reads from the stream in batches, reducing per-transaction overhead. Kinesis maintains ordering within a shard, useful for velocity calculations over ordered card activity.

AWS DocsLambda with Kinesis

Amazon Bedrock: Analyst Narrative

For each REVIEW/BLOCK transaction, invoke a Bedrock foundation model to generate a plain-English investigation brief. The brief surfaces which factors contributed, what the pattern resembles, and what additional data an analyst should check. This transforms the dashboard from a metrics display into an investigation tool.

AWS DocsAmazon Bedrock

SageMaker: ML Scoring Model

Replace the rule-based scoring engine with a SageMaker-hosted XGBoost model trained on historical labelled transaction data. The Scorer Lambda invokes the SageMaker endpoint via the InvokeEndpoint API. Rule-based and ML scores can be blended in an ensemble during the transition period.

AWS DocsSageMaker model deployment

Project Links

Live Demo View GitHub Back to Projects